Only allow admin to update acl

+ Add auth user library and authenticate user making request
+ Only allow update if authenticator is admin
small fix to acl
Update acl.js

Small fixes
indentation fix